Linux PPPD Has A 17 Year Old Vulnerability That Could Lead To Remote Code Execution

It turns out the Point-to-Point Protocol Daemon (PPPD) used for dial-up models, DSL, and other point-to-point network setups on Linux has been bugged for the past seventeen years with a buffer overflow vulnerability that could lead to remote code execution at the system level.

Going back to PPPD 2.4.2 in 2003 up through PPPD 2.4.8 as the latest stable release is subject to a buffer overflow in the EAP packet processing code. Due to an incorrect bounds check, there is the possibility of arbitrary code execution within this high profile Linux daemon.

By sending an unsolicited EAP packet to a vulnerable ppp client or server, an unauthenticated remote attacker could cause memory corruption in the pppd process, which may allow for arbitrary code execution.

More details on this PPPD vulnerability via CERT.org.

A new release of PPPD isn't yet available but the fixed bounds check patch is within the PPP Git repository.